Lan

**Name of the Vulnerable Software and Affected Versions** Dify versions prior to 1.14.2 **Description** An authorization bypass allows authenticated editor users to set and enable trace configurations for any application, regardless of tenant ownership. This occurs due to missing tenant ownership checks in the trace configuration endpoints, enabling attackers to redirect all messages and responses from victim applications to LLM trace providers under their control. Dify Cloud facilitates this by allowing unauthenticated free self-registration for account creation. **Recommendations** Update to version 1.14.2 or later.